Capital One Breach Settlement Details: Eligibility and Remaining Benefits

The Capital One breach settlement is a $190 million class action resolution of claims arising from the 2019 hack that exposed personal data belonging to roughly 106 million people in the United States and Canada. All cash payments to class members have already been distributed, and the claim filing period is closed. What remains active is free identity defense and fraud restoration services through Pango, available to any class member through February 13, 2028.¹

Who the Settlement Covers

The class includes roughly 98 million Capital One applicants and cardholders in the United States and Canada whose information was compromised in the 2019 breach. Direct notice went to individuals whose Social Security numbers, Social Insurance Numbers, or linked bank account numbers were among the exposed data, because that group was eligible for the enhanced tier of identity protection.²

You don’t need to have filed a claim to use the services that remain available. Enrollment and the restoration hotline are open to any class member.¹

What You Can Still Get

Two benefits remain live: identity defense services and restoration services. Both are provided by Pango and both run through February 13, 2028.

Identity Defense Services

The baseline package includes dark web monitoring for Social Security numbers, dates of birth, addresses, driver’s licenses, passports, payment cards, and email addresses. It also provides identity monitoring with authentication alerts, lost wallet protection, and the ability to place security freezes across credit bureaus and specialty finance databases. The coverage carries $1 million in no-deductible identity theft and fraud insurance.¹

Class members whose Social Security numbers or linked bank account numbers were exposed get an enhanced tier that adds three-bureau credit monitoring with instant alerts and monthly credit scores.³

To enroll, call Pango at 833-317-4821 for an enrollment code, then complete sign-up through the enrollment portal. Enrollment is open until the February 13, 2028 end date.¹

Restoration Services

Restoration services are available to every class member, regardless of whether you ever filed a claim and regardless of whether you enroll in the identity defense package. If you believe you’ve been a victim of identity theft or fraud, you can call 505-896-7416 to work with a fraud resolution specialist. They can help you place fraud alerts, dispute inaccurate credit report entries, contact creditors and service providers, and coordinate with law enforcement.¹

What’s Closed

Cash relief under the settlement is done. The claim filing deadline passed on September 30, 2022, after being extended once from an original August 22, 2022 date.⁴ Initial payments to approved claimants went out starting September 28, 2023, and a second round followed on September 4, 2024. All monetary distributions are now complete, no further reissue requests are being accepted, and any uncashed checks are void.¹

If you have general questions about your prior claim or the settlement, the administrator can be reached at 1-855-604-1811 (Monday through Friday, 6 a.m. to 6 p.m. PST) or at info@CapitalOneSettlement.com.⁵

What the Cash Benefits Looked Like

While claims were open, the settlement offered three forms of relief. Documented out-of-pocket losses tied to the breach, including fraudulent charges, identity-theft prevention costs, and professional data security help, were reimbursable up to $25,000 per class member. Lost time was compensable for up to 15 hours at a rate of at least $25 per hour. Identity defense services were, and remain, available to the whole class.⁶

Capital One also agreed to implement and maintain specified cybersecurity improvements for at least two years as part of the deal.⁶ The settlement administrator processed more than 200,000 claims; payouts were calculated from documented losses and time-based compensation, with pro-rata adjustments where valid claims exceeded available funds.¹

Judge Anthony J. Trenga of the U.S. District Court for the Eastern District of Virginia granted final approval on September 13, 2022, finding the settlement fair, reasonable, and adequate. Only four substantive objections were filed from a class of roughly 98 million members, and the court overruled each one.⁶

The Underlying Breach

On March 22 and 23, 2019, an unauthorized individual exploited a misconfigured web application firewall on a Capital One server hosted by Amazon Web Services and pulled out large volumes of customer data. Capital One didn’t discover the intrusion until July 19, 2019, after an outside security researcher flagged a configuration vulnerability two days earlier.⁷

About 100 million people in the United States and 6 million in Canada were affected.⁸ Most of the stolen information came from credit card applications submitted between 2005 and early 2019 and included names, addresses, phone numbers, email addresses, dates of birth, and self-reported income. For existing cardholders, the hacker also accessed credit scores, credit limits, balances, payment history, and fragments of transaction data drawn from 23 days spread across 2016 to 2018.⁷

More sensitive identifiers were exposed in smaller numbers: roughly 140,000 U.S. Social Security numbers (with another 4,700 identified in a later 2021 analysis), about 80,000 linked bank account numbers, and roughly one million Canadian Social Insurance Numbers. No credit card account numbers or login credentials were exposed.⁷

A Note on Amazon and the Criminal Case

Amazon Web Services, which hosted the breached server, was named as a co-defendant in the consolidated class action. Amazon did not contribute money to the $190 million fund but received a release from further class claims related to the breach as part of the deal.³

The criminal prosecution of the hacker, Paige Thompson, is a separate matter and doesn’t affect your access to the settlement benefits above. Thompson was convicted in June 2022 on one count of wire fraud and six counts of computer fraud and abuse, and was ordered to pay $40.7 million in restitution.⁹

1
Capital One Settlement. Capital One Data Breach Settlement
2
For The People. Capital One $190M Data Breach Settlement
3
Capital One Settlement. Memo in Support of Motion for Preliminary Approval
4
Top Class Actions. Capital One Data Breach $190M Class Action Settlement
5
Capital One Settlement. Capital One Data Breach Settlement – Contact
6
Capital One Settlement. Final Approval Order
7
Capital One. 2019 Cyber Incident Facts
8
FTC. Capital One Data Breach: Time to Check Your Credit Report
9
CyberScoop. Court Reimposes Original Sentence for Capital One Hacker